The vulnerability is an unauthenticated remote code execution flaw caused by deserialization of untrusted data when the application is configured to use a particular communication mode. An attacker can send crafted input to the service and cause arbitrary code to run with the privileges of the host process, potentially leading to full system compromise, data exfiltration, or persistence. The weakness is identified as CWE-502, a deserialization flaw that allows execution of malicious code.

SolarWinds Observability Self‑Hosted installations are impacted. The vulnerability applies to any deployed version that is older than the patched release 2026.2.3 and that has the vulnerable communication mode enabled. No specific version range is provided in the CVE, so all current releases without the patch are considered at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of 2% suggests a low but non‑zero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The flaw is unauthenticated and can be triggered over the network by sending malicious serialized data to the service when the vulnerable mode is active. An attacker does not need any valid credentials, and the exploit path is likely straightforward for actors with the capability to craft and transmit the offending data. The combination of high impact, lack of authentication barrier, and the absence of usable defensive measures for external traffic makes the risk significant for exposed environments.